{"id":"CVE-2018-11776","published":"2018-08-22T13:29:00Z","modified":"2026-06-17T01:36:34Z","title":"Apache Struts Remote Code Execution Vulnerability","vendor":"Apache","product":"Struts","tier":"core","eol":null,"description":{"text":"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","provenance":"source","from":"NVD"},"summary":{"text":"Apache Struts (the Apache web application framework) contains a flaw in its namespace handling that can lead to remote code execution when alwaysSelectFullNamespace is enabled, either by user configuration or through a plugin such as the Convention Plugin, affecting versions 2.3 to 2.3.34 and 2.5 to 2.5.16. An attacker with network access and no privileges could exploit it without user interaction, provided the application uses results without a namespace, or url tags lacking value and action attributes, under a parent package that has no namespace or a wildcard namespace.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:38Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99996,"percentile":0.99989,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-11776","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-12-18","exploitedFirstSeen":"2018-12-18","ransomware":true,"evidence":[{"url":"https://blog.talosintelligence.com/2018/12/cryptomining-campaigns-2018.html","date":"2018-12-18"},{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://blogs.juniper.net/en-us/threat-research/satan-ransomware-used-in-multi-platform-cryptomining-and-ransomware-campaign","date":"2019-06-15"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf","date":"2023-11-09"},{"url":"https://www.aquasec.com/blog/sink-or-swim-tackling-2024s-record-breaking-vulnerability-wave/","date":"2024-09-19"},{"url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","date":"2025-05-27"},{"url":"https://www.labs.greynoise.io/grimoire/2025-12-26-coldfusion/","date":"2025-12-26"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/105125","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041547","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041888","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-057","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/hook-s3c/CVE-2018-11776-Python-PoC","tags":["Exploit","Third Party Advisory"]},{"url":"https://lgtm.com/blog/apache_struts_CVE-2018-11776","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180822-0001/","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45260/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45262/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45367/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/105125","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041547","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041888","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-057","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/hook-s3c/CVE-2018-11776-Python-PoC","tags":["Exploit","Third Party Advisory"]},{"url":"https://lgtm.com/blog/apache_struts_CVE-2018-11776","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180822-0001/","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/45260/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45262/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45367/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. Volexity also reports active scanning and attempts to exploit CVE-2018-11776 in order to deploy cryptocurrency miners.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-cb282516a718c0bcfb32","title":"WTB: Remote Mac Exploitation Via Custom URL Schemes","publisher":"anomali.com","url":"https://www.anomali.com/blog/wtb-remote-mac-exploitation-via-custom-url-schemes","date":null,"mentions":[{"quote":"The vulnerability, which is known as CVE-2018-11776, comes from an improper validation of namespace input data, and threat actors have already exploited this to install a CNRig cryptocurrency miner on machines.","start":2784,"end":2994}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.4, <2.3.35",">=2.5, <2.5.17"],"patched":["2.3.35","2.5.17"],"from":["GHSA-cr6j-3jp9-rw65"],"provenance":"source"}],"advisories":[{"id":"GHSA-cr6j-3jp9-rw65","url":"https://github.com/advisories/GHSA-cr6j-3jp9-rw65","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.4, <2.3.35"],"patched":["2.3.35"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cr6j-3jp9-rw65","url":"https://github.com/advisories/GHSA-cr6j-3jp9-rw65","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.5, <2.5.17"],"patched":["2.5.17"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0582","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0582","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":45260,"url":"https://www.exploit-db.com/exploits/45260","title":"Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)","type":"remote","platform":"linux","date":"2018-08-26","verified":false,"provenance":"source"},{"id":45262,"url":"https://www.exploit-db.com/exploits/45262","title":"Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)","type":"remote","platform":"multiple","date":"2018-08-25","verified":false,"provenance":"source"},{"id":45367,"url":"https://www.exploit-db.com/exploits/45367","title":"Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)","type":"remote","platform":"multiple","date":"2018-09-10","verified":true,"provenance":"source"},{"id":45367,"url":"https://www.exploit-db.com/exploits/45367","title":"Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)","type":"remote","platform":"multiple","date":"2018-09-10","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2018-08-25"},"pocGithub":{"count":15,"skipped":2,"earliest":"2018-08-23","earliestUrl":"https://github.com/xfox64x/CVE-2018-11776","repos":[{"name":"mazen160/struts-pwn_CVE-2018-11776","url":"https://github.com/mazen160/struts-pwn_CVE-2018-11776","stars":304,"created":"2018-08-25"},{"name":"hook-s3c/CVE-2018-11776-Python-PoC","url":"https://github.com/hook-s3c/CVE-2018-11776-Python-PoC","stars":123,"created":"2018-08-24"},{"name":"649/Apache-Struts-Shodan-Exploit","url":"https://github.com/649/Apache-Struts-Shodan-Exploit","stars":56,"created":"2018-08-29"},{"name":"Ekultek/Strutter","url":"https://github.com/Ekultek/Strutter","stars":21,"created":"2018-08-27"},{"name":"arlyone/Apache-Struts-0Day-Exploit","url":"https://github.com/arlyone/Apache-Struts-0Day-Exploit","stars":17,"created":"2019-10-10"}]},"metasploit":[{"name":"Apache Struts 2 Namespace Redirect OGNL Injection","module":"exploit/multi/http/struts2_namespace_ognl","type":"exploit","disclosureDate":"2018-08-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_namespace_ognl.rb"}],"nuclei":[{"id":"CVE-2018-11776","name":"Apache Struts2 S2-057 - Remote Code Execution","severity":"high","path":"http/cves/2018/CVE-2018-11776.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11776.yaml"}],"first":{"date":"2018-08-22","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_namespace_ognl.rb"},"provenance":"source"},"exploitRefs":["https://github.com/hook-s3c/CVE-2018-11776-Python-PoC","https://lgtm.com/blog/apache_struts_CVE-2018-11776","https://www.exploit-db.com/exploits/45260/","https://www.exploit-db.com/exploits/45262/","https://www.exploit-db.com/exploits/45367/","http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/45367","https://www.exploit-db.com/exploits/45262","https://www.exploit-db.com/exploits/45260"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1496"],"provenance":"source"},{"stage":"related","techniques":["T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-08-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11776","provenance":"source"},{"date":"2018-08-22","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-08-23, Exploit-DB 2018-08-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_namespace_ognl.rb","provenance":"source"},{"date":"2018-12-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/2018/12/cryptomining-campaigns-2018.html","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0582","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1169},"priority":{"score":82.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2872 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 4 Exploit-DB entries; 1 NVD exploit link; 3 advisory exploit references; 15 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-struts-cve-2013-2134","parents":[{"from":"CVE-2013-2134","to":"CVE-2018-11776","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/StrutsConstants.java","core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java"],"commits":["https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e5"],"basis":"shared function","functions":["parseNameAndNamespace","setAlwaysSelectFullNamespace"]}]},{"from":"CVE-2013-2135","to":"CVE-2018-11776","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/StrutsConstants.java","core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java"],"commits":["https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e5"],"basis":"shared function","functions":["parseNameAndNamespace","setAlwaysSelectFullNamespace"]}]},{"from":"CVE-2016-4438","to":"CVE-2018-11776","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["plugins/rest/src/main/java/org/apache/struts2/rest/RestActionMapper.java"],"commits":["https://github.com/apache/struts/commit/6d7ac40dcede1793a4534a3dc249fd562d495e8c","https://github.com/apache/struts/commit/76eb8f38a33ad0f1f48464ee1311559c8d52dd6d","https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e5"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-12611","published":"2017-09-20","fixed":"2.5.11","kev":false,"link":{"from":"CVE-2017-12611","to":"CVE-2018-11776","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.34","toFixed":"2.3.35","daysApart":336}]}},{"cve":"CVE-2016-4465","published":"2016-07-04","fixed":"2.5.13","kev":false},{"cve":"CVE-2016-8738","published":"2017-09-20","fixed":"2.5.13","kev":false},{"cve":"CVE-2017-9804","published":"2017-09-20","fixed":"2.5.13","kev":false,"link":{"from":"CVE-2017-9804","to":"CVE-2018-11776","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.13","toFixed":"2.5.17","daysApart":336}]}},{"cve":"CVE-2018-11776","published":"2018-08-22","fixed":"2.5.17","kev":true},{"cve":"CVE-2012-1592","published":"2019-12-05","fixed":"2.5.22","kev":false,"link":{"from":"CVE-2018-11776","to":"CVE-2012-1592","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.17","toFixed":"2.5.22","daysApart":470}]}},{"cve":"CVE-2019-0230","published":"2020-09-14","fixed":"2.5.22","kev":false},{"cve":"CVE-2019-0233","published":"2020-09-14","fixed":"2.5.22","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}